Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240419-en -
resource tags
arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system -
submitted
07-05-2024 05:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ffe0ce191143afd76370fd2cd83ecf76d644a6bf077bde9e92c20b84e6cea62f.exe
Resource
win10v2004-20240426-en
7 signatures
150 seconds
General
-
Target
ffe0ce191143afd76370fd2cd83ecf76d644a6bf077bde9e92c20b84e6cea62f.exe
-
Size
263KB
-
MD5
2b22a1399c5c0154571ffb9297924585
-
SHA1
a6fd42447b10e1457343d4b38d733010596dcd65
-
SHA256
ffe0ce191143afd76370fd2cd83ecf76d644a6bf077bde9e92c20b84e6cea62f
-
SHA512
a6e72e48099fe856a4006ad364f5b763df2169e5b029ebe2e4b0681850b9b101f38f53b56b7b9361dd10cfa35677a3fd9f4e50f661aa15b91714b6b0dd0aef5c
-
SSDEEP
3072:mgO69y2CthWMtmdmsj1kJiWYcHVia8b52cU4J++ciQV7OW5R70RsNh:u694rtmr1kJiWYcHAT52xt+cRV/QQ
Malware Config
Extracted
Family
gcleaner
C2
185.172.128.90
5.42.65.64
Attributes
-
url_path
/advdlc.php
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 8 IoCs
pid pid_target Process procid_target 4588 4236 WerFault.exe 78 4760 4236 WerFault.exe 78 4968 4236 WerFault.exe 78 2332 4236 WerFault.exe 78 124 4236 WerFault.exe 78 3796 4236 WerFault.exe 78 3560 4236 WerFault.exe 78 1192 4236 WerFault.exe 78 -
Kills process with taskkill 1 IoCs
pid Process 3372 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3372 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4236 wrote to memory of 3880 4236 ffe0ce191143afd76370fd2cd83ecf76d644a6bf077bde9e92c20b84e6cea62f.exe 95 PID 4236 wrote to memory of 3880 4236 ffe0ce191143afd76370fd2cd83ecf76d644a6bf077bde9e92c20b84e6cea62f.exe 95 PID 4236 wrote to memory of 3880 4236 ffe0ce191143afd76370fd2cd83ecf76d644a6bf077bde9e92c20b84e6cea62f.exe 95 PID 3880 wrote to memory of 3372 3880 cmd.exe 98 PID 3880 wrote to memory of 3372 3880 cmd.exe 98 PID 3880 wrote to memory of 3372 3880 cmd.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\ffe0ce191143afd76370fd2cd83ecf76d644a6bf077bde9e92c20b84e6cea62f.exe"C:\Users\Admin\AppData\Local\Temp\ffe0ce191143afd76370fd2cd83ecf76d644a6bf077bde9e92c20b84e6cea62f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4236 -s 7722⤵
- Program crash
PID:4588
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4236 -s 7922⤵
- Program crash
PID:4760
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4236 -s 8242⤵
- Program crash
PID:4968
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4236 -s 8682⤵
- Program crash
PID:2332
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4236 -s 9762⤵
- Program crash
PID:124
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4236 -s 9802⤵
- Program crash
PID:3796
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4236 -s 14522⤵
- Program crash
PID:3560
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "ffe0ce191143afd76370fd2cd83ecf76d644a6bf077bde9e92c20b84e6cea62f.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\ffe0ce191143afd76370fd2cd83ecf76d644a6bf077bde9e92c20b84e6cea62f.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "ffe0ce191143afd76370fd2cd83ecf76d644a6bf077bde9e92c20b84e6cea62f.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3372
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4236 -s 14682⤵
- Program crash
PID:1192
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4236 -ip 42361⤵PID:240
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4236 -ip 42361⤵PID:3676
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4236 -ip 42361⤵PID:992
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4236 -ip 42361⤵PID:1332
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4236 -ip 42361⤵PID:1152
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4236 -ip 42361⤵PID:4828
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4236 -ip 42361⤵PID:2784
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4236 -ip 42361⤵PID:4188